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SUBJECT ;  Report  on  Quality  Control  Review 

of  Arthur  Andersen,  LLP,  for  0MB  Cireular  No.  A- 133  Audit  Report  of 
the  Henry  M.  Jaekson  Foundation  for  the  Advaneement  of  Military  Medieine, 
Fiseal  Year  Ended  September  30,  1998 
Report  No.  D-2001-6-001  (Projeet  No.  D2000-OA-0169) 

We  are  providing  this  report  for  your  review  and  comment.  On  December  15,  1998, 
the  firm  of  Arthur  Andersen,  LLP  (Arthur  Andersen),  issued  the  single  audit  report  for  the 
Henry  M.  Jackson  Foundation  for  the  Advancement  of  Military  Medicine  (the  Foundation). 

The  Foundation,  based  in  Rockville,  Maryland,  is  a  non-profit  organization  that  was  chartered 
by  Congress  in  1983  to  support  military  medical  research  and  education  and  to  promote  public- 
private  partnerships  in  that  area.  The  audit  is  required  by  the  Office  of  Management  and 
Budget  (0MB)  Circular  No.  A-133,  “Audits  of  States,  Local  Governments,  and  Non-Profit 
Organizations,”  (the  Circular  A-133).  For  the  fiscal  year  ended  September  30,  1998,  the 
Foundation  reported  total  Federal  expenditures  of  $63.9  million  consisting  of  $53  million  for 
the  DoD  and  $10.9  million  for  other  Federal  agencies. 

Quality  Control  Review  Objective.  As  the  cognizant  agency  for  the  Foundation,  the  Office 
of  Inspector  General,  DoD,  performed  a  quality  control  review  to  determine  whether  the 
FY  1998  audit  report  that  the  Foundation  submitted  to  the  Single  Audit  Clearinghouse  met  the 
applicable  reporting  standards  and  whether  Arthur  Andersen  conducted  the  audit  in  accordance 
with  applicable  standards  and  the  Circular  A-133.  See  Appendix  A  for  a  discussion  of  the 
scope,  prior  quality  control  reviews  related  to  Arthur  Andersen,  and  single  audit  requirements. 

Review  Results.  Arthur  Andersen  complied  with  the  Circular  A-133  in  performing  the  audit 
of  the  financial  statements  and  in  reporting  on  internal  controls  and  compliance  related  to  the 
financial  reporting.  However,  Arthur  Andersen  needed  to  improve  the  documentation  and  test 
of  internal  controls  for  compliance  with  requirements  applicable  to  the  major  programs 
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(finding  A).  Moreover,  the  Foundation  did  not  ensure  that  the  single  audit  required  by  the 
Cireular  A- 133  was  properly  eoordinated  between  Arthur  Andersen  and  the  Defense  Contraet 
Audit  Ageney  (DCAA)  (finding  B). 

Finding  A.  Performance  of  FY  1998  Single  Audit.  Arthur  Andersen  provided  a  eomplete 
reporting  paekage  that  eomplied  with  the  Cireular  A- 133  for  the  finaneial  statements  and 
related  reporting  requirements.  However,  Arthur  Andersen  needed  to  improve  the  planning 
and  exeeution  of  the  review  of  eomplianee  with  requirements  applieable  to  the  major  program. 
In  addition,  the  working  papers  needed  to  better  doeument  the  work  performed  to  support  the 
auditor  eonelusions  on  eomplianee  with  requirements. 

Review  of  Internal  Control  Over  Compliance.  The  Arthur  Andersen  working  papers 
eontained  a  general  understanding  of  the  Foundation's  internal  eontrol  system.  Arthur 
Andersen  properly  identified  whieh  of  the  14  eomplianee  requirements  applied  to  the  3 
sampled  Federal  awards  under  the  Foundation’s  major  program,  Researeh  and  Development. 
Appendix  A  shows  the  14  eomplianee  requirements  and  those  that  applied  to  the  Foundation 
program.  Arthur  Andersen  had  an  audit  plan  that  assessed  internal  eontrols  for  finaneial 
statements.  However,  Arthur  Andersen  did  not  separately  review  and  doeument  eaeh  of  the  5 
eomponents  of  internal  eontrol  (eontrol  environment,  risk  assessments,  eontrol  aetivities, 
information  and  eommunieation,  and  monitoring)  in  general  or  for  the  10  applieable 
eomplianee  requirements. 

Both  generally  aeeepted  auditing  standards  and  the  generally  aeeepted 
government  auditing  standards  (GAGAS)  require  that  to  plan  the  audit,  the  auditor  perform 
eertain  proeedures  in  order  to  understand  the  design  of  eontrols  and  to  determine  whether  the 
eontrols  have  been  implemented.  The  Cireular  A- 133  and  the  Complianee  Supplement 
(Supplement)  require  the  auditor  to  identify  whieh  of  the  14  eomplianee  requirements  apply  to 
the  major  programs  and  to  evaluate  the  5  eomponents  of  internal  eontrol  for  eaeh  applieable 
requirement.  The  understanding  obtained  from  this  assessment  must  be  doeumented  in  the 
working  papers  to  support  the  audit  plan. 

The  Arthur  Andersen  standard  audit  program  did  not  inelude  steps  for  reviewing 
the  five  eomponents  separately  for  eaeh  relevant  eomplianee  requirement.  However,  Arthur 
Andersen  relied  heavily  on  guidanee  provided  by  the  Supplement  when  auditing  eaeh 
applieable  eomplianee  requirement.  Therefore,  the  audit  planning  defieieneies  were  partially 
offset  by  the  method  used  to  exeeute  the  aetual  audit  work.  Arthur  Anderson  ean  ensure  a 
more  effieient  and  adequate  audit  by  assessing,  as  part  of  its  planning  proeess,  the  five 
eomponents  of  internal  eontrol. 

Review  of  Internal  Control  Over  Compliance  Reqnirements.  The  working  papers 
eontained  some  evidenee  that  testing  of  eontrols  was  performed;  however,  the  working  papers 
did  not  eontain  a  suffieient  deseription  of  the  sampling  plan  or  doeumentation  of  the  testing 
done  as  required  by  GAGAS. 
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Documentation  of  Sampling  Plan.  The  working  papers  did  not  explain  whieh 
speeifie  testing  methodology  or  eriteria  for  eaeh  transaetion  reviewed  was  used  to  determine 
when  the  eost  was  allowable  under  the  0MB  Cireular  No.  A-122,  “Cost  Prineiples  for  Non- 
Profit  Organizations.”  Therefore,  we  in  turn  eould  not  determine  whieh  of  the  speeifie 
proeedures  were  applied  to  test  eaeh  Federal  award.  Speeifieally,  the  working  papers  did  not 
inelude  suffieient  information  on  the  sampling  plan  to  support  its  use  in  fulfilling  the 
eomplianee  requirement  testing  on  eost  allowability.  The  Arthur  Andersen  sampling  objeetives 
were  not  speeifie  and  did  not  identify  whether  a  eost  was  eharged  direetly  or  indireetly,  and 
whether  it  was  for  materials,  overhead,  or  labor.  The  sampling  plan  did  not  identify  the 
allowability  eriteria  in  0MB  Cireular  No.  A-122  that  was  being  tested.  The  sampling  plan 
should  have  identified  the  population  and  its  eharaeteristies  for  testing  eost  allowability. 

Documentation  of  Compliance  Testing.  Compliance  requirement  testing 
consists  of  examining  transactions  to  provide  auditors  with  sufficient  evidence  to  support  an 
opinion  on  compliance.  Of  the  10  applicable  compliance  requirements  audited,  we  re-tested  3. 
The  working  papers  for  one  of  the  three,  “Reporting,”  included  sufficient  documentation  to 
support  the  audit  conclusion.  However,  the  working  papers  for  the  other  two  compliance 
requirements,  “activities  allowed/unallowed”  and  “allowable  costs/cost  principles,”  did  not 
adequately  document  the  work  performed.  GAGAS  requires  that  the  form  and  content  of  the 
working  papers  should  allow  an  experienced  auditor  to  determine  the  evidence  that  supports 
the  auditor’s  significant  conclusions  and  judgments. 

In  general,  the  working  papers  should  document  the  objectives,  scope,  and 
methodology,  including  the  sampling  criteria  the  auditors  used.  We  could  not  determine  the 
adequacy  of  the  work  performed  because  insufficient  evidence  existed  in  the  working  papers  to 
support  the  audit  judgments  and  conclusions.  The  working  papers  contained  only  a  check 
number  identifying  what  was  tested.  Specifically,  the  working  papers  should  also  identify  the 
Federal  award  number,  name  and  type  (such  as  grant,  cooperative  agreement  or  contract)  and 
voucher  documents  reviewed  (such  as  an  invoice  or  purchase  order). 

In  addition,  the  working  papers  should  include  an  adequate  description  of 
transactions  tested,  such  as  showing  the  type  of  cost  (labor,  material,  or  overhead),  its  amount, 
and  date/time  period,  as  well  as  whether  it  was  charged  directly  or  indirectly. 

However,  through  re-testing  selected  compliance  requirements,  we  were  able  to 
draw  the  same  conclusions  as  Arthur  Andersen.  Therefore,  we  accepted  the  audit  conclusions 
despite  the  inadequate  documentation. 

Summary.  Arthur  Andersen’s  working  papers  were  insufficient  to  support  their  conclusions 
concerning  compliance  with  requirements.  However,  through  re-testing  and  other  means,  we 
were  able  to  obtain  reasonable  assurance  of  the  conclusions  drawn  by  Arthur  Andersen.  In 
conducting  future  single  audits,  Arthur  Anderson  should; 

•  review  and  document  the  five  internal  control  components  for  each  applicable 
compliance  requirement; 
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•  properly  document  any  sampling  plan  used;  and 

•  adequately  document  the  tests  performed  on  the  compliance  requirements 
including  criteria,  judgments,  and  conclusions. 

Recommendations 

A.  We  recommend  that  Arthur  Andersen,  LLP: 

1 .  Revise  its  audit  program  for  the  single  audit  to  comply  with  the  requirements 
of  the  Circular  A- 133  to  include  audit  steps  that  document  an  understanding  of  the  5  internal 
control  elements  related  to  each  of  the  applicable  14  compliance  requirements. 

2.  Improve  the  working  papers  by  documenting  its  judgments,  procedures,  and 
results  or  conclusions  with  relevant  and  sufficient  evidence,  including  the  sampling  plan. 

Finding  B.  Coordination  of  Single  Audit.  The  Foundation  should  better  coordinate  the 
single  audit.  Although  Arthur  Andersen  relied  on  the  DCAA  audit  of  indirect  cost  and  cost 
allocations  as  support  for  the  review  of  compliance  with  requirements,  better  coordination 
would  result  in  more  efficient  and  economical  use  of  each  audit  organization's  work.  The 
Single  Audit  Act  and  the  Circular  A- 133  require  that  audits  be  planned  in  such  a  way  as  to 
build  on  audit  work  performed  by  others. 

Coordination  Between  Audit  Organizations.  In  November  1998,  the  Foundation 
engaged  Arthur  Andersen  to  provide  all  FY  1998  audit  services  required  to  meet  the  intent  of 
the  Circular  A- 133.  The  Arthur  Andersen  engagement  letter  did  not  mention  coordination  of 
the  single  audit  work  with  DCAA.  The  DCAA  also  performed  work  at  the  Foundation  on  the 
allowability  of  direct  costs  and  indirect  cost  rates  for  establishing  negotiated  carryforwards  as 
part  of  an  incurred  cost  review.  However,  neither  the  DCAA  nor  the  Arthur  Andersen 
working  papers  documented  any  coordination  between  the  audit  organizations  to  determine  the 
work  each  should  perform  so  that  they  could  rely  on  each  other’s  work,  avoid  possible 
duplication  of  effort,  and  better  fulfill  the  Circular  A- 133  requirements. 

Despite  the  lack  of  pre-audit  coordination,  Arthur  Andersen,  after  reviewing  DCAA 
audit  flies,  relied  on  DCAA  audit  work  relating  to  indirect  cost  allocations.  However,  both 
audit  organizations  did  testing  of  the  "allowable  cost/cost  principles"  requirement.  Although 
DCAA  reviewed  Arthur  Andersen  working  papers  for  the  allowable  cost/cost  principles 
requirements,  they  were  unable  to  totally  use  the  already  completed  work  because  of 
inadequate  documentation. 

In  addition,  Arthur  Andersen  did  not  identify  additional  pertinent  DCAA  audit  work 
that  they  could  have  relied  on.  On  September  30,  1998,  DCAA  issued  a  report  on  “Audit  of 
Contractor's  Timekeeping  System.”  The  audit  reviewed  the  allocability  of  labor  costs  to 
appropriate  cost  objectives  and  could  have  been  relied  on  by  Arthur  Anderson  to  support  its 
acceptance  of  the  Foundation  labor  costs.  Without  the  DCAA  audit  report,  the  Arthur 
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Andersen  work  relating  to  labor  eosts  would  have  been  inadequate,  and  additional  audit  work 
would  have  been  required  to  properly  eomplete  the  FY  1998  audit. 

Summary.  To  inerease  effieieney  and  aehieve  a  more  eost-effeetive  audit,  the  Foundation 
must  reeognize  its  responsibility  in  better  eoordinating  the  single  audit.  Better  pre-audit 
eoor dination  would  have  allowed  relianee  on  eaeh  other’s  work  and  may  have  eliminated  some 
of  the  defieieneies  we  identified  in  the  review  of  internal  eontrol  over  eomplianee. 

Recommendation 

B.  We  reeommend  that  the  Direetor  of  Aeeounting,  Henry  M.  Jaekson  Foundation, 
eoordinate  the  audit  between  the  independent  publie  aeeountant  retained  to  perform  the  single 
audit  and  the  Defense  Contraet  Audit  Ageney  to  avoid  duplieation  and  to  aehieve  a  eomplete 
and  eost-effeetive  audit.  The  engagement  letter  should  inelude  the  requirement  to  attend  a 
eoordination  meeting  prior  to  beginning  the  audit. 

Comments  Required.  Beeause  this  report  eontains  findings  and  reeommendations,  written 
eomments  are  required.  Please  provide  your  eomments,  ineluding  appropriate  eorreetive 
aetions,  to  us  by  Mareh  7,  2001.  We  appreeiate  the  eourtesies  extended  during  the  review.  If 
you  have  questions  on  this  report,  please  eontaet  Mr.  Wayne  C.  Berry  at  (703)  604-8789 
(wberry@dodig.osd.mil)  or  Mr.  Martin  I.  Gordon  at  (703)  604-8738 
(mgordon@dodig.osd.mil).  The  report  distribution  is  at  Appendix  B.  The  evaluation  team 
members  are  listed  inside  the  baek  eover. 


Patrieia  A.  Brannin 
Deputy  Assistant  Inspeetor  General 
for  Audit  Poliey  and  Oversight 
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Appendix  A.  Quality  Control  Review  Process 

Scope  and  Methodology 

We  conducted  a  quality  control  review  of  Arthur  Anderson,  LLP,  audit  of  the  Henry 
M.  Jackson  Foundation  for  the  Advancement  of  Military  Medicine  (Foundation)  for  the 
fiscal  year  ended  September  30,  1998,  and  the  resulting  reporting  submission  to  the 
Single  Audit  Clearinghouse  dated  March  11,  1999.  We  performed  our  review  using  the 
1999  edition  of  the  “Uniform  Quality  Control  Guide  for  the  A-133  Audits”  (the  Guide). 
The  Guide  applies  to  any  single  audit  that  is  subject  to  the  requirements  of  0MB 
Circular  A-133,  “Audits  of  States,  Local  Governments,  and  Non-Profit  Organizations,” 
revised  June  24,  1997  (the  Circular  A-133).  The  Guide  is  the  approved  checklist  of  the 
President’s  Council  on  Integrity  and  Efficiency  for  performing  the  quality  control 
review  procedures.  We  reviewed  the  audit  as  required  by  the  Circular  A-133,  GAGAS 
issued  by  the  Comptroller  General  of  the  United  States,  and  generally  accepted  auditing 
standards  issued  by  the  American  Institute  of  Certified  Public  Accountants.  Our  review 
was  conducted  from  May  2000  through  January  2001  and  covered  areas  related  to  the 
financial  statements  and  a  major  program,  categorized  as  a  cluster  program  of  research 
and  development.  As  the  cognizant  audit  agency  for  the  Foundation,  we  focused  our 
review  on  the  following  qualitative  aspects  of  the  single  audit; 

•  Qualifications  of  auditors 

•  Independence 

•  Due  professional  care 

•  Quality  control 

•  Planning  and  supervision 

•  Internal  control  and  compliance  testing 

•  Schedule  of  Expenditures  of  Federal  Awards 

•  Schedule  of  Findings  and  Questioned  Costs 

•  Data  Collection  Form 


Prior  Quality  Control  Reviews 


We  performed  one  quality  control  review  for  FY  ending  1993  that  concluded  the  audit 
satisfied  the  Circular  A-133  requirements.  We  also  did  three  desk  reviews  for  FYs  of 
1991,  1995,  and  1996,  with  no  reportable  conditions. 
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Single  Audit  Requirements 


The  Circular  A- 133  establishes  policies  to  guide  implementation  of  the  Single  Audit  Act 
1984  (Public  Law  98-502)  and  the  Single  Audit  Act  Amendments  of  1996  (Publication 
104-156).  The  Circular  A- 133  provides  an  administrative  foundation  for  uniform  audit 
requirements  for  non-Federal  entities  that  administer  Federal  awards.  In  addition,  the 
Circular  A- 133  serves  to  ensure  that  Federal  departments  and  agencies  rely  on  and  use 
the  audit  work  to  the  maximum  extent  practicable.  To  meet  the  intent  of  the  law  and 
the  Circular  A- 133,  a  complete  reporting  package  on  each  single  audit  is  submitted  to 
the  Single  Audit  Clearinghouse  from  the  auditee  (non-Federal  entity)  that  includes  the 
following; 

•  Data  collection  form  certified  by  the  auditee  that  the  audit  was  completed 
according  to  the  0MB  Circular  A- 133; 

•  Financial  statements  and  related  opinion; 

•  Schedule  of  Expenditures  of  Federal  Awards  and  related  opinion; 

•  Report  on  internal  control  and  compliance  review  related  to  the  financial 
statements; 

•  Report  on  internal  control  over  compliance  and  on  compliance  with  laws, 
regulations,  and  the  provisions  of  contracts  or  grant  agreements,  and  related 
opinion  on  compliance  of  major  programs;  and 

•  Schedule  of  Findings  and  Questioned  Costs. 

0MB  issues  a  Compliance  Supplement  (the  Supplement)  annually.  The  Supplement 
assists  the  auditors  in  determining  the  audit  scope  for  the  Circular  A- 133  requirements 
for  review  of  internal  control.  For  each  compliance  requirement,  the  Supplement 
describes  the  objectives  of  internal  control  and  certain  characteristics  that  when  present 
and  operating  effectively  may  ensure  compliance  with  program  requirements.  The 
Supplement  gives  examples  of  the  common  characteristics  for  the  five  components  of 
internal  control  (control  environment,  risk  assessment,  control  activities,  information 
and  communication,  and  monitoring)  for  each  compliance  requirement.  The  following 
14  compliance  requirements  applicable  to  the  various  Federal  programs  are  identified  in 
the  Supplement: 


A. 

Activities  Allowed/Unallowed 

*H. 

Period  of  Availability  of  Eederal  Eunds 

*B. 

Allowable  Costs/Cost  Principles 

T. 

Proeurement  and  Suspension  and 

*C. 

Cash  Management 

Debarment 

‘D. 

Davis-Bacon  Act 

*J. 

Program  Income 

E. 

Eligibility  of  Eederal  Eunds 

K. 

Real  Property  Acquisition/Relocation 

*F. 

Equipment  and  Real  Property 

Assistance 

Management 

*L. 

Reporting 

G. 

Matching,  Level  of  Effort, 

M. 

Subrecipient  Monitoring 

Earmarking 

*N. 

Special  Tests  and  Provisions 

*  Compliance  requirements  applicable  to  reviewed  Federal  awards  at  the  Henry  M.  Jackson 
Foundation. 
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Appendix  B.  Report  Distribution 


Mr.  Ben  Bernstein,  Direetor  of  Aeeounting 
Henry  M.  Jaekson  Foundation  for  the 
Advaneement  of  Military  Medieine 
1401  Roekville  Pike,  Suite  600 
Roekville,  MD  20852 

Mr.  Robert  C.  Kovarik,  Partner 
Arthur  Andersen,  LLP 
8000  Towers  Creseent  Drive 
Vienna,  VA  22182 

Mr.  Lawrenee  Uhlfelder 
Assistant  Direetor,  Poliey  and  Plans 
Defense  Contraet  Audit  Ageney 
8725  John  J.  Kingman  Road,  Suite  2353 
Fort  Belvoir,  VA  22060-6219 

Direetor 

Defense  Contraet  Management  Ageney 
8725  John  J.  Kingman  Road,  Suite  4539 
Fort  Belvoir,  VA  22060-3060 

Naval  Medieal  Researeh  Center 
Forest  Glen  Annex 
503  Robert  Grant  Rd. 

Silver  Spring,  MD  20910-7500 

U.S.  Army  Soldiers  Systems  Command 
Aequisition  Direetorate 
Natiek,  MA  01760-5011 

Uniformed  Serviees  University  of  the 
Health  Seienee 

e/o  Contraet  Dept.  Mr.  Denton 
4301  Jones  Bridge  Road 
Bethesda,  MD  20814-4799 


Department  of  Energy 
Offiee  of  Inspeetor  General 
ATTN :  Single  Audit  Contraet 
IG-33,  Rm  5A-193 
1000  Independenee  Ave.,  SW 
Washington,  DC  20585 

HHS  OIG  National  External 
Audit  Resourees 
Lueas  Plaee 

323  West  8*  Street,  Room  514 
Kansas  City,  MO  64105 

NASA  Offiee  of  Inspeetor  General 
NASA  Headquarters,  Code  W 
Washington,  DC  20546-0001 

Offiee  of  Inspeetor  General 
National  Seienee  Foundation 
Assistant  Inspeetor  General  for  Audit 
4201  Wilson  Boulevard,  Suite  1135 
Arlington,  VA  22230 

Direetor 

Planning  and  Operational 
Support  Division  (52P) 

Department  of  Veterans  Affairs 
810  Vermont  Ave.,  NW 
Washington,  DC  20420 

Regional  Inspeetor  General  for  Auditing 
General  Serviees  Administration 
Washington  Field  Audit  Offiee  (JA-W) 
7th  &  D  Street  SW,  Room  1064 
Washington,  DC  20407 

Defense  Contraet  Audit  Ageney 
Columbia  Braneh  Offiee 
One  Mall  North,  Suite  200 
1025  Governor  Warfield  Parkway 
Columbia,  MD  21044 
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Evaluation  Team  Members 


The  Deputy  Assistant  Inspeetor  General  for  Audit  Poliey  and  Oversight,  Offiee  of  the 
Assistant  Inspeetor  General  for  Auditing,  DoD,  prepared  this  report.  Personnel  of  the 
Offiee  of  the  Inspeetor  General,  DoD,  who  eontributed  to  the  report  are  listed  below. 

Wayne  C.  Berry 
Diane  H.  Stetler 
Martin  I.  Gordon 


